# QR code goes to a dead domain

> A lapsed domain is the worst QR failure, because after roughly 30 days of grace and a 30-day redemption period anyone can re-register it, including an attacker who inherits every code you ever printed. If it is yours, restore it during redemption. Then turn on auto-renew, add years, and lock the registrar account.

Source: https://useqr.app/docs/troubleshooting/qr-code-goes-to-a-dead-domain · Last reviewed 2026-08-21 · UseQR is free forever, no signup.

---

## Why this is the worst destination failure

A [404](/docs/troubleshooting/qr-code-opens-a-404) is a broken link. A lapsed domain is a **transferable asset**: once it is released, whoever registers it next inherits every scan from every code you ever printed, posters, packaging, business cards, all still out in the world, all still sending traffic. At best the new owner parks it with ads. At worst it becomes a lookalike login page harvesting the credentials of people who trusted *your* printed material: the [quishing](/docs/security/quishing-explained) attack with the hardest part, distribution, already done for the attacker. Printed QR codes make domain expiry a physical-world security problem.

## The clock: what happens when a domain lapses

For typical gTLDs (.com, .org, .net and most new extensions):

| Phase | Typical length | What you can do |
|---|---|---|
| Expired, registrar grace | 0–45 days, varies by registrar | Renew at the normal price |
| Redemption period | 30 days | Restore it, with a fee well above the renewal price |
| Pending delete | 5 days | Nothing: wait, and prepare to re-register |
| Released | n/a | Anyone can register it, including drop-catch services |

Country-code TLDs run their own timelines, sometimes much shorter. Drop-catching services register desirable names within moments of release, so "I'll just re-register it next week" is not a plan.

## If it is (or was) your domain

Act immediately: every day moves you toward a worse phase and a higher price. In grace, renew normally; in redemption, pay the restoration fee without hesitating. It is cheap against reprinting an estate of codes. If the domain has already been taken by someone else, treat every printed code as **compromised, not merely broken**: physically remove or cover them, and tell your audience through another channel not to scan old materials.

## If it is someone else's domain

You printed a partner's URL, a vendor's, a shortener's, and their domain died. You cannot rescue a domain you never owned, so withdraw the codes and check what loads now: a parked page is a warning, a lookalike login form is an active incident worth reporting. Decode any suspect code with our [scanner](/scan) to see the raw URL without visiting it: the safe-checking routine is at [how to check a QR code before opening it](/docs/security/how-to-check-a-qr-code-before-opening).

## Prevention

- **Auto-renew, plus years in the bank.** Register the domain years ahead: renewal is cheap and the failure is not.
- **Fix the mundane root cause.** Most accidental expiries trace to an expired payment card silently failing auto-renewal. Keep a backup card on the registrar account and treat registrar emails as production alerts.
- **Lock it.** Enable transfer lock; for a high-value domain, ask about registry lock.
- **Inventory the printed estate.** Keep a list of every URL you have ever printed and check each one on a schedule: printed codes outlive [campaigns, tools and memories](/docs/basics/do-qr-codes-expire), and this failure is only cheap when caught in the grace period.

## FAQ

### What happens to QR codes when the domain expires?
Every printed code keeps sending scanners to that domain: first to an error or parking page, and after re-registration to whatever the new owner chooses to host. The codes cannot be recalled; only the domain's fate decides where they lead.

### Can someone take over my old QR codes?
Yes. Once a lapsed domain is released, anyone can register it and instantly controls the destination of every code that references it. Re-registered domains behind trusted printed materials are an established phishing pattern.

### How long do I have to recover an expired domain?
Typically a registrar grace period of up to 45 days at normal price, then about 30 days of redemption at a higher restoration fee, then around 5 days of pending delete. After that it is open to anyone, including drop-catchers.

### Is a parked page at my old QR destination dangerous?
It is a warning shot: the domain has changed hands and now serves ads. The danger is what it can become overnight: the new owner can host anything, so treat printed codes pointing there as compromised and withdraw them.

## Try it

- https://useqr.app/scan
- https://useqr.app/url
- https://useqr.app/validate